fix: lock pypdf to patched release

tests/test_project_metadata.py

@@ -1,4 +1,15 @@
 from pathlib import Path
+import re
+
+
+def _locked_package_version(name: str) -> tuple[int, ...]:
+    text = Path("uv.lock").read_text(encoding="utf-8")
+    match = re.search(
+        rf'\[\[package\]\]\nname = "{re.escape(name)}"\nversion = "([^"]+)"',
+        text,
+    )
+    assert match is not None, f"package {name!r} missing from uv.lock"
+    return tuple(int(part) for part in match.group(1).split("."))
 
 
 def test_project_metadata_does_not_bundle_mineru_extra():
@@ -42,3 +53,7 @@ def test_project_declares_locked_fuzz_extra_without_bundling_nvidia_stack():
     assert '"atheris==3.0.0 ;' in text
     assert '"pyinstaller==6.16.0"' in text
     assert "nvidia = [" not in text
+
+
+def test_uv_lock_pins_pypdf_at_patched_release():
+    assert _locked_package_version("pypdf") >= (6, 10, 0)